4c08a8f3c94eb025877f8cb8ae3018578183d5b5e829280fee70fb700f04e428 | Triage

Analysis

max time kernel
303s
max time network
350s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 16:35

Sharing

Report Analysis Logs

General

Target

Fortnite Hack v1.17/For injector.exe
Size

1.3MB
MD5

a31422ef39673af212a59246119a44c5
SHA1

5b1f4747f07fac059a8c81edddf1589e99d2ac35
SHA256

d8c8215f4975a29c43e4d016b2ecd5c8c072ed4da6571736ebabd38509ca33ba
SHA512

6630631643c0cbae96e7ed2098eaf82e6645a974a89211051a2137254e24b1b4b51137b9b0388799870fd9733e3e0f7214b98ca2e64f76feb27b2ec5ac8718bb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 1732 WerFault.exe For injector.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

For injector.exe

description	pid	process	target process
PID 1732 wrote to memory of 1280	1732	For injector.exe	WerFault.exe
PID 1732 wrote to memory of 1280	1732	For injector.exe	WerFault.exe
PID 1732 wrote to memory of 1280	1732	For injector.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Fortnite Hack v1.17\For injector.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite Hack v1.17\For injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1732 -s 508
2⤵
- Program crash
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-55-0x0000000000000000-mapping.dmp

Download
memory/1732-54-0x000000013F860000-0x000000013F9AC000-memory.dmp

Filesize
1.3MB

Download